diff options
| author | Dmitry Antipov <dmantipov@yandex.ru> | 2023-08-02 19:07:17 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@kernel.org> | 2023-08-21 18:56:27 +0300 |
| commit | 968d02c61311221deb881634d15f191effa1ab22 (patch) | |
| tree | 20bef5b146ffc8604dea2bf0ffb0c82830a29260 /drivers/net/wireless/marvell | |
| parent | 9b1cd8266f350c4e8453361c6e183e6174d63e4b (diff) | |
| download | linux-968d02c61311221deb881634d15f191effa1ab22.tar.xz | |
wifi: mwifiex: handle possible sscanf() errors
Return -EINVAL on possible 'sscanf()' errors in
'mwifiex_regrdwr_write()' and 'mwifiex_rdeeprom_write()'.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230802160726.85545-3-dmantipov@yandex.ru
Diffstat (limited to 'drivers/net/wireless/marvell')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/debugfs.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c index 0cdd6c50c1c0..f9c9fec7c792 100644 --- a/drivers/net/wireless/marvell/mwifiex/debugfs.c +++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c @@ -425,7 +425,10 @@ mwifiex_regrdwr_write(struct file *file, if (IS_ERR(buf)) return PTR_ERR(buf); - sscanf(buf, "%u %x %x", ®_type, ®_offset, ®_value); + if (sscanf(buf, "%u %x %x", ®_type, ®_offset, ®_value) != 3) { + ret = -EINVAL; + goto done; + } if (reg_type == 0 || reg_offset == 0) { ret = -EINVAL; @@ -691,7 +694,10 @@ mwifiex_rdeeprom_write(struct file *file, if (IS_ERR(buf)) return PTR_ERR(buf); - sscanf(buf, "%d %d", &offset, &bytes); + if (sscanf(buf, "%d %d", &offset, &bytes) != 2) { + ret = -EINVAL; + goto done; + } if (offset == -1 || bytes == -1) { ret = -EINVAL; |